[PR #6333] [MERGED] profiles: loupe: harden and disable apparmor #5964

New issue

Closed

opened 2026-05-05 10:48:12 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:48:12 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/6333
Author: @kmk3
Created: 5/8/2024
Status: ✅ Merged
Merged: 5/12/2024
Merged by: @kmk3

Base: master ← Head: loupe-warn-disable

📝 Commits (1)

dd61c47 profiles: loupe: harden and disable apparmor

📊 Changes

1 file changed (+10 additions, -2 deletions)

View changed files

📝 etc/profile-a-l/loupe.profile (+10 -2)

📄 Description

The profile currently does not include disable-common nor makes
${HOME} read-only, so the program can simply write to ~/.bashrc
directly[1].

disable-common.inc was commented due to it apparently breaking bwrap.
As discovered by @glitsj16, it seems that allowing the bwrap binary is
enough to make it work (and that apparmor breaks loupe)[2].

So disable apparmor, allow bwrap and include disable-common.inc, plus
other hardening by @glitsj16.

This amends commit 9a0db13e1 ("profiles: add loupe", 2024-04-30) /
PR #6327.

[1] https://github.com/netblue30/firejail/pull/6327#pullrequestreview-2033860865
[2] https://github.com/netblue30/firejail/pull/6333#issuecomment-2099805480

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/6333 **Author:** [@kmk3](https://github.com/kmk3) **Created:** 5/8/2024 **Status:** ✅ Merged **Merged:** 5/12/2024 **Merged by:** [@kmk3](https://github.com/kmk3) **Base:** `master` ← **Head:** `loupe-warn-disable` --- ### 📝 Commits (1) - [`dd61c47`](https://github.com/netblue30/firejail/commit/dd61c47f21a4d303d99459a15ffcde8c275d490b) profiles: loupe: harden and disable apparmor ### 📊 Changes **1 file changed** (+10 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `etc/profile-a-l/loupe.profile` (+10 -2) </details> ### 📄 Description The profile currently does not include disable-common nor makes `${HOME}` read-only, so the program can simply write to ~/.bashrc directly[1]. disable-common.inc was commented due to it apparently breaking bwrap. As discovered by @glitsj16, it seems that allowing the bwrap binary is enough to make it work (and that apparmor breaks loupe)[2]. So disable apparmor, allow bwrap and include disable-common.inc, plus other hardening by @glitsj16. This amends commit 9a0db13e1 ("profiles: add loupe", 2024-04-30) / PR #6327. [1] https://github.com/netblue30/firejail/pull/6327#pullrequestreview-2033860865 [2] https://github.com/netblue30/firejail/pull/6333#issuecomment-2099805480 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror

2026-05-05 10:48:12 -06:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#5964

No description provided.

Rows
Columns