mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
e46d9adcf1
disable-common.inc has these lines:
blacklist ${PATH}/nc
blacklist ${PATH}/nc.openbsd
blacklist ${PATH}/nc.traditional
blacklist ${PATH}/ncat
With openbsd-netcat on Artix, `/usr/bin/nc.openbsd` is symlinked to
`/usr/bin/nc`:
$ pacman -Fl gnu-netcat openbsd-netcat | grep bin/nc
gnu-netcat usr/bin/nc
openbsd-netcat usr/bin/nc
openbsd-netcat usr/bin/nc.openbsd
$ realpath /usr/bin/nc.openbsd
/usr/bin/nc
So `noblacklist ${PATH}/nc` is not enough, as
`blacklist ${PATH}/nc.openbsd` will follow the symlink to `/usr/bin/nc`
and still blacklist it.
To prevent `/usr/bin/nc` from being blacklisted,
`noblacklist ${PATH}/nc.openbsd` is also needed in this case.
To ensure that netcat is allowed, always `noblacklist` all netcat paths.
Fixes #6911.
|
||
|---|---|---|
| .. | ||
| apparmor | ||
| inc | ||
| net | ||
| profile-a-l | ||
| profile-m-z | ||
| templates | ||
| firejail.config | ||
| login.users | ||