[PR #4643] [MERGED] Profile Checks #5215

New issue

Closed

opened 2026-05-05 10:34:21 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:34:21 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/4643
Author: @rusty-snake
Created: 10/26/2021
Status: ✅ Merged
Merged: 10/29/2021
Merged by: @kmk3

Base: master ← Head: profile-checks

📝 Commits (4)

23c4234 Add alteratives and ld.so.cache to all private-etc lines
d43904e Sort disaple-programs.inc
ac0f95a Sort src/firecfg/firecfg.config
0aa6664 Add Profile Checks

📊 Changes

217 files changed (+448 additions, -420 deletions)

View changed files

➕ .github/workflows/profile-checks.yml (+31 -0)
➖ .github/workflows/sort.yml (+0 -21)
➕ ci/check/profiles/private-etc-always-required.sh (+15 -0)
➕ ci/check/profiles/sort-disable-programs.sh (+2 -0)
➕ ci/check/profiles/sort-firecfg.config.sh (+2 -0)
➕ ci/check/profiles/sort.py (+1 -0)
📝 etc/inc/disable-programs.inc (+174 -176)
📝 etc/profile-a-l/abiword.profile (+1 -1)
📝 etc/profile-a-l/agetpkg.profile (+1 -1)
📝 etc/profile-a-l/alacarte.profile (+1 -1)
📝 etc/profile-a-l/anki.profile (+1 -1)
📝 etc/profile-a-l/aria2c.profile (+1 -1)
📝 etc/profile-a-l/arm.profile (+1 -1)
📝 etc/profile-a-l/artha.profile (+1 -1)
📝 etc/profile-a-l/atool.profile (+1 -1)
📝 etc/profile-a-l/authenticator-rs.profile (+1 -1)
📝 etc/profile-a-l/balsa.profile (+1 -1)
📝 etc/profile-a-l/bibletime.profile (+1 -1)
📝 etc/profile-a-l/bijiben.profile (+1 -1)
📝 etc/profile-a-l/bitwarden.profile (+1 -1)

...and 80 more files

📄 Description

First three commits fix things so CI can pass:

23c4234d70: Add alteratives and ld.so.cache to all private-etc lines
d43904edbc: Sort disaple-programs.inc
ac0f95aabb: Sort src/firecfg/firecfg.config

The last commit (225909d4eb2d40425d4e1590f100d35180d2780f) adds Profile Checks. For now I added four check but once we have this infrastructure for profile checks it is easier to add more in follow-up PRs.

Run sort.py (and remove the old sort.py workflow)
private-etc-always-required.sh checks that some files are always allowed with private-etc (ATOW that are alternatives ld.so.cache ld.so.preload). It can not check redirect profiles, therefore some files are double allowed if both profile (redirect profile and redirected profile) contain a private-etc line. Anyway nothing bad will happen.
sort-disable-programs.sh checks that disable-programs.inc is sorted. I also dropped to separate ~/.cache as this complicates sorting without advantages.
sort-firecfg.config.sh checks that firecfg.config is sorted.

Possible follow-up PRs:

Check presents of header and .locals includes
Check usage of whitelist ${HOME}/... without wc
Check private-etc containing every necessary network files (for networking progrms)
Check missing usage of allow includes
Check machine-id but no nosound
...

cc @jose1711

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/4643 **Author:** [@rusty-snake](https://github.com/rusty-snake) **Created:** 10/26/2021 **Status:** ✅ Merged **Merged:** 10/29/2021 **Merged by:** [@kmk3](https://github.com/kmk3) **Base:** `master` ← **Head:** `profile-checks` --- ### 📝 Commits (4) - [`23c4234`](https://github.com/netblue30/firejail/commit/23c4234d709fccc4a78d64aec0adbd6a22db5909) Add alteratives and ld.so.cache to all private-etc lines - [`d43904e`](https://github.com/netblue30/firejail/commit/d43904edbc697eab0d3c6e3cfb10e823d8a47979) Sort disaple-programs.inc - [`ac0f95a`](https://github.com/netblue30/firejail/commit/ac0f95aabba60e81f4070c305d560cac40ad70e4) Sort src/firecfg/firecfg.config - [`0aa6664`](https://github.com/netblue30/firejail/commit/0aa66649efa11e9c3c4d341f8a42f2eef8e942de) Add Profile Checks ### 📊 Changes **217 files changed** (+448 additions, -420 deletions) <details> <summary>View changed files</summary> ➕ `.github/workflows/profile-checks.yml` (+31 -0) ➖ `.github/workflows/sort.yml` (+0 -21) ➕ `ci/check/profiles/private-etc-always-required.sh` (+15 -0) ➕ `ci/check/profiles/sort-disable-programs.sh` (+2 -0) ➕ `ci/check/profiles/sort-firecfg.config.sh` (+2 -0) ➕ `ci/check/profiles/sort.py` (+1 -0) 📝 `etc/inc/disable-programs.inc` (+174 -176) 📝 `etc/profile-a-l/abiword.profile` (+1 -1) 📝 `etc/profile-a-l/agetpkg.profile` (+1 -1) 📝 `etc/profile-a-l/alacarte.profile` (+1 -1) 📝 `etc/profile-a-l/anki.profile` (+1 -1) 📝 `etc/profile-a-l/aria2c.profile` (+1 -1) 📝 `etc/profile-a-l/arm.profile` (+1 -1) 📝 `etc/profile-a-l/artha.profile` (+1 -1) 📝 `etc/profile-a-l/atool.profile` (+1 -1) 📝 `etc/profile-a-l/authenticator-rs.profile` (+1 -1) 📝 `etc/profile-a-l/balsa.profile` (+1 -1) 📝 `etc/profile-a-l/bibletime.profile` (+1 -1) 📝 `etc/profile-a-l/bijiben.profile` (+1 -1) 📝 `etc/profile-a-l/bitwarden.profile` (+1 -1) _...and 80 more files_ </details> ### 📄 Description First three commits fix things so CI can pass: - 23c4234d709fccc4a78d64aec0adbd6a22db5909: Add alteratives and ld.so.cache to all private-etc lines - d43904edbc697eab0d3c6e3cfb10e823d8a47979: Sort disaple-programs.inc - ac0f95aabba60e81f4070c305d560cac40ad70e4: Sort src/firecfg/firecfg.config The last commit (225909d4eb2d40425d4e1590f100d35180d2780f) adds Profile Checks. For now I added four check but once we have this infrastructure for profile checks it is easier to add more in follow-up PRs. - Run sort.py (and remove the old sort.py workflow) - private-etc-always-required.sh checks that some files are always allowed with `private-etc` (ATOW that are `alternatives ld.so.cache ld.so.preload`). It can not check redirect profiles, therefore some files are double allowed if both profile (redirect profile and redirected profile) contain a `private-etc` line. Anyway nothing bad will happen. - sort-disable-programs.sh checks that disable-programs.inc is sorted. I also dropped to separate `~/.cache` as this complicates sorting without advantages. - sort-firecfg.config.sh checks that firecfg.config is sorted. Possible follow-up PRs: - Check presents of header and .locals includes - Check usage of `whitelist ${HOME}/...` without wc - Check `private-etc` containing every necessary network files (for networking progrms) - Check missing usage of allow includes - Check `machine-id` but no `nosound` - ... cc @jose1711 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror

2026-05-05 10:34:21 -06:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#5215

No description provided.

Rows
Columns