mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-21 06:45:29 -06:00
bb9107e2ae
This reverts commitbd1819a864, reversing changes made to807af3dce0. The hole PR looks like a single crap, it is not even syntactically correct. Has anyone at least started kmail with this profile before it was merged? See #3979, thanks @creideiki for reporting. > First, there are syntax errors. Several mkdir lines have file names containing asterisks. > This gives the following error: > > Error: "${HOME}/.cache/akonadi*" is an invalid filename: rejected character: "*" > > I am not sure what they intend to do, but whatever it is it's not working. > Especially confusing is the line > > mkdir /tmp/akonadi-* > > Yes, Akonadi creates a directory in /tmp, but its name is random and seems to have been created > using mkstemp(3) or similar. I'm not sure how Firejail is supposed to be able to pre-create it. > > Removing the asterisks makes Firejail at least accept the profile syntactically and try to run > the program. It is rejected by syntax. Has anyone tested? > At startup, Firejail now prints the following warning: > > *** > *** Warning: cannot whitelist ${DOCUMENTS} directory > *** Any file saved in this directory will be lost when the sandbox is closed. > *** Why was 'include disable-xdg.inc' added together with 'whitelist ${DOCUMENTS}', but no 'nobalcklist ${DOCUMENTS}'? It can not work. > The actual error is that PostgreSQL needs access to /usr/lib64/postgresql-13/ in order to run. > Adding the following line to kmail.profile fixes that: > > whitelist /usr/share/postgresql* Again, has anyone thested this? > The next problem is this message on the console: > > kf.config.core: Couldn't write "/home/creideiki/.config/kmail2rc" . Disk full? > > Which may have something to do with the profile creating a directory with that name: > > mkdir ${HOME}/.config/kmail2rc > > when it's supposed to be a file: > > $ stat ~/.config/kmail2rc > File: /home/creideiki/.config/kmail2rc > Size: 24660 Blocks: 56 IO Block: 4096 regular file Has anyone tested this or is this just a blind copy of the noblacklist from above with noblacklist replaced by mkdir? > However, the error message > > kf.config.core: Couldn't write "/home/creideiki/.config/kmail2rc" . Disk full? > > still appears. Looks like #1793. HAS ANYONE TESTED THIS PROFILE??! > Finally, when exiting KMail, it crashes with a SIGSEGV: > > *** KMail got signal 11 (Exiting) > *** Dead letters dumped. > KCrash: crashing... crashRecursionCounter = 2 > KCrash: Application Name = kmail path = /usr/bin pid = 20 > KCrash: Arguments: /usr/bin/kmail Has any... > I tried restoring an older kmail.profile, from commit319f2dc, and it has none of the above problems. ... I give up asking if anyone tested this. > Given the multitude of problems with commit5532fbd, I'd suggest reverting it until it can be fixed. Yes, definitely.
62 lines
1.9 KiB
Text
62 lines
1.9 KiB
Text
# Firejail profile for kmail
|
|
# Description: Full featured graphical email client
|
|
# This file is overwritten after every install/update
|
|
# Persistent local customizations
|
|
include kmail.local
|
|
# Persistent global definitions
|
|
include globals.local
|
|
|
|
# kmail has problems launching akonadi in debian and ubuntu.
|
|
# one solution is to have akonadi already running when kmail is started
|
|
|
|
noblacklist ${HOME}/.cache/akonadi*
|
|
noblacklist ${HOME}/.cache/kmail2
|
|
noblacklist ${HOME}/.config/akonadi*
|
|
noblacklist ${HOME}/.config/baloorc
|
|
noblacklist ${HOME}/.config/emaildefaults
|
|
noblacklist ${HOME}/.config/emailidentities
|
|
noblacklist ${HOME}/.config/kmail2rc
|
|
noblacklist ${HOME}/.config/kmailsearchindexingrc
|
|
noblacklist ${HOME}/.config/mailtransports
|
|
noblacklist ${HOME}/.config/specialmailcollectionsrc
|
|
noblacklist ${HOME}/.gnupg
|
|
noblacklist ${HOME}/.local/share/akonadi*
|
|
noblacklist ${HOME}/.local/share/apps/korganizer
|
|
noblacklist ${HOME}/.local/share/contacts
|
|
noblacklist ${HOME}/.local/share/emailidentities
|
|
noblacklist ${HOME}/.local/share/kmail2
|
|
noblacklist ${HOME}/.local/share/kxmlgui5/kmail
|
|
noblacklist ${HOME}/.local/share/kxmlgui5/kmail2
|
|
noblacklist ${HOME}/.local/share/local-mail
|
|
noblacklist ${HOME}/.local/share/notes
|
|
noblacklist /tmp/akonadi-*
|
|
|
|
include disable-common.inc
|
|
include disable-devel.inc
|
|
include disable-exec.inc
|
|
include disable-interpreters.inc
|
|
include disable-passwdmgr.inc
|
|
include disable-programs.inc
|
|
|
|
include whitelist-var-common.inc
|
|
|
|
# apparmor
|
|
caps.drop all
|
|
netfilter
|
|
nodvd
|
|
nogroups
|
|
nonewprivs
|
|
noroot
|
|
nosound
|
|
notv
|
|
nou2f
|
|
novideo
|
|
protocol unix,inet,inet6,netlink
|
|
# we need to allow chroot, io_getevents, ioprio_set, io_setup, io_submit system calls
|
|
seccomp !chroot,!io_getevents,!io_setup,!io_submit,!ioprio_set
|
|
# tracelog
|
|
|
|
private-dev
|
|
# private-tmp - interrupts connection to akonadi, breaks opening of email attachments
|
|
# writable-run-user is needed for signing and encrypting emails
|
|
writable-run-user
|