debug output
+
+Output of
+
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 00000000000..b8fe40acd1d
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+ - name: Question
+ url: https://github.com/netblue30/firejail/discussions
+ about: For questions you should use GitHub Discussions.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
new file mode 100644
index 00000000000..a723cdbde01
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -0,0 +1,23 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+---
+
+### Is your feature request related to a problem? Please describe.
+
+_A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]_
+
+### Describe the solution you'd like
+
+_A clear and concise description of what you want to happen._
+
+### Describe alternatives you've considered
+
+_A clear and concise description of any alternative solutions or features you've considered._
+
+### Additional context
+
+_Add any other context or screenshots about the feature request here._
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 71791c0008f..7cb92a93855 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,10 +1,9 @@
-
If your PR isn't about profiles or you have no idea how to do one of these, skip the following and go ahead with this PR.
-If you make a PR for new profiles or changeing profiles please do the following:
- - The ordering of options follow the rules descripted in [/usr/share/doc/firejail/profile.template](https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template).
- > Hint: The profile-template is very new, if you install firejail with your package-manager, it maybe missing, therefore, and to follow the latest rules, it is recommended to use the template from the repository.
- - Order the arguments of options alphabetical, you can easy do this with the [sort.py](https://github.com/netblue30/firejail/tree/master/contrib/sort.py).
+If you submit a PR for new profiles or changing profiles, please do the following:
+ - The ordering of options follow the rules described in [/usr/share/doc/firejail/profile.template](https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template).
+ > Hint: The profile-template is very new. If you install firejail with your package manager, it may be missing. In order to follow the latest rules, it is recommended to use the template from the repository.
+ - Order the arguments of options alphabetically. You can easily do this with [sort.py](https://github.com/netblue30/firejail/tree/master/contrib/sort.py).
The path to it depends on your distro:
| Distro | Path |
diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml
new file mode 100644
index 00000000000..fd1f2395423
--- /dev/null
+++ b/.github/workflows/build-extra.yml
@@ -0,0 +1,55 @@
+name: Build-extra CI
+
+on:
+ push:
+ branches: [ master ]
+ paths-ignore:
+ - CONTRIBUTING.md
+ - README
+ - README.md
+ - RELNOTES
+ - SECURITY.md
+ - 'etc/**'
+ - 'src/firecfg/firecfg.config'
+ - '.github/ISSUE_TEMPLATE/*'
+ - '.github/pull_request_template.md'
+ pull_request:
+ branches: [ master ]
+ paths-ignore:
+ - CONTRIBUTING.md
+ - README
+ - README.md
+ - RELNOTES
+ - SECURITY.md
+ - 'etc/**'
+ - 'src/firecfg/firecfg.config'
+ - '.github/ISSUE_TEMPLATE/*'
+ - '.github/pull_request_template.md'
+
+jobs:
+ build-clang:
+ runs-on: ubuntu-20.04
+ steps:
+ - uses: actions/checkout@v2
+ - name: configure
+ run: CC=clang-11 ./configure --enable-fatal-warnings
+ - name: make
+ run: make
+ scan-build:
+ runs-on: ubuntu-20.04
+ steps:
+ - uses: actions/checkout@v2
+ - name: install clang-tools-11
+ run: sudo apt-get install clang-tools-11
+ - name: configure
+ run: CC=clang-11 ./configure --enable-fatal-warnings
+ - name: scan-build
+ run: NO_EXTRA_CFLAGS="yes" scan-build-11 --status-bugs make
+ cppcheck:
+ runs-on: ubuntu-20.04
+ steps:
+ - uses: actions/checkout@v2
+ - name: install cppcheck
+ run: sudo apt-get install cppcheck
+ - name: cppcheck
+ run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance .
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 00000000000..141e4316884
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,35 @@
+name: Build CI
+
+on:
+ push:
+ branches: [ master ]
+ paths-ignore:
+ - CONTRIBUTING.md
+ - README
+ - README.md
+ - RELNOTES
+ - SECURITY.md
+ pull_request:
+ branches: [ master ]
+ paths-ignore:
+ - CONTRIBUTING.md
+ - README
+ - README.md
+ - RELNOTES
+ - SECURITY.md
+
+jobs:
+ build_and_test:
+ runs-on: ubuntu-20.04
+ steps:
+ - uses: actions/checkout@v2
+ - name: install dependencies
+ run: sudo apt-get install gcc-11 libapparmor-dev libselinux1-dev expect xzdec
+ - name: configure
+ run: CC=gcc-11 ./configure --enable-fatal-warnings --enable-analyzer --enable-apparmor --enable-selinux --prefix=/usr
+ - name: make
+ run: make
+ - name: make install
+ run: sudo make install
+ - name: run tests
+ run: SHELL=/bin/bash make test-github
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 00000000000..4476963b5ed
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,75 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+name: "CodeQL"
+
+on:
+ push:
+ branches: [ master ]
+ paths-ignore:
+ - CONTRIBUTING.md
+ - README
+ - README.md
+ - RELNOTES
+ - SECURITY.md
+ - 'etc/**'
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [ master ]
+ paths-ignore:
+ - CONTRIBUTING.md
+ - README
+ - README.md
+ - RELNOTES
+ - SECURITY.md
+ - 'etc/**'
+ schedule:
+ - cron: '0 7 * * 2'
+
+jobs:
+ analyze:
+ name: Analyze
+ runs-on: ubuntu-latest
+
+ strategy:
+ fail-fast: false
+ matrix:
+ language: [ 'cpp', 'python' ]
+ # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
+ # Learn more:
+ # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v2
+
+ # Initializes the CodeQL tools for scanning.
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v1
+ with:
+ languages: ${{ matrix.language }}
+ # If you wish to specify custom queries, you can do so here or in a config file.
+ # By default, queries listed here will override any specified in a config file.
+ # Prefix the list here with "+" to use these queries and those in the config file.
+ # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+ # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
+ # If this step fails, then you should remove it and run the build manually (see below)
+ - name: Autobuild
+ uses: github/codeql-action/autobuild@v1
+
+ # ℹ️ Command-line programs to run using the OS shell.
+ # 📚 https://git.io/JvXDl
+
+ # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+ # and modify them (or add more) to build your code if your project
+ # uses a compiled language
+
+ #- run: |
+ # make bootstrap
+ # make release
+
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v1
diff --git a/.github/workflows/sort.yml b/.github/workflows/sort.yml
new file mode 100644
index 00000000000..cfa40d2d2db
--- /dev/null
+++ b/.github/workflows/sort.yml
@@ -0,0 +1,21 @@
+name: sort.py
+
+on:
+ push:
+ branches: [ master ]
+ paths:
+ - 'etc/**'
+ - 'contrib/sort.py'
+ pull_request:
+ branches: [ master ]
+ paths:
+ - 'etc/**'
+ - 'contrib/sort.py'
+
+jobs:
+ profile-sort:
+ runs-on: ubuntu-20.04
+ steps:
+ - uses: actions/checkout@v2
+ - name: check profiles
+ run: ./contrib/sort.py etc/*/{*.inc,*.profile}
diff --git a/.gitignore b/.gitignore
index 39380446bf1..ace86f218cd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,7 +6,10 @@
*.rpm
*.gcda
*.gcno
+*.DS_Store
.directory
+*.man
+.vscode
Makefile
autom4te.cache/
config.log
@@ -19,10 +22,13 @@ firejail-users.5
firejail.1
firemon.1
firecfg.1
+jailcheck.1
+mkdeb.sh
src/firejail/firejail
src/firemon/firemon
src/firecfg/firecfg
src/ftee/ftee
+src/fids/fids
src/tags
src/faudit/faudit
src/fnet/fnet
@@ -33,7 +39,10 @@ src/fsec-optimize/fsec-optimize
src/fcopy/fcopy
src/fldd/fldd
src/fbuilder/fbuilder
-etc/profstats
+src/profstats/profstats
+src/bash_completion/firejail.bash_completion
+src/zsh_completion/_firejail
+src/jailcheck/jailcheck
uids.h
seccomp
seccomp.debug
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2205c796ce9..03e18d26934 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -9,7 +9,7 @@ build_ubuntu_package:
image: ubuntu:rolling
script:
- apt-get update -qq
- - apt-get install -y -qq build-essential lintian pkg-config python3
+ - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential lintian pkg-config python3 gawk
- ./configure --prefix=/usr && make deb && dpkg -i firejail*.deb
- python3 contrib/sort.py etc/profile-*/*.profile etc/inc/*.inc
@@ -17,15 +17,15 @@ build_debian_package:
image: debian:stretch
script:
- apt-get update -qq
- - apt-get install -y -qq build-essential lintian pkg-config
+ - apt-get install -y -qq build-essential lintian pkg-config gawk
- ./configure --prefix=/usr && make deb && dpkg -i firejail*.deb
-#build_redhat_package:
-# image: centos:latest
-# script:
-# - yum update -y
-# - yum install -y rpm-build gcc make
-# - ./configure --prefix=/usr && make rpms && yum install -y firejail*.rpm
+build_redhat_package:
+ image: centos:latest
+ script:
+ - dnf update -y
+ - dnf install -y rpm-build gcc make
+ - ./configure --prefix=/usr && make rpms && rpm -i firejail*.rpm
build_fedora_package:
image: fedora:latest
@@ -40,7 +40,7 @@ build_src_package:
script:
- apk update
- apk upgrade
- - apk add build-base linux-headers python3
+ - apk add build-base linux-headers python3 gawk
- ./configure --prefix=/usr && make && make install-strip
# - python3 contrib/sort.py etc/*.{profile,inc}
@@ -48,16 +48,8 @@ build_apparmor:
image: ubuntu:latest
script:
- apt-get update -qq
- - apt-get install -y -qq build-essential lintian libapparmor-dev pkg-config
- - ./configure --prefix=/usr && make deb-apparmor && dpkg -i firejail-apparmor*.deb
-
-cppcheck:
- image: debian:latest
- before_script:
- - apt-get -qq update
- - apt-get -qq --no-install-recommends install cppcheck
- script:
- - cppcheck -q --force --error-exitcode=1 --enable=warning,performance .
+ - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential lintian libapparmor-dev pkg-config gawk
+ - ./configure --prefix=/usr && make deb-apparmor && dpkg -i firejail*.deb
debian_ci:
image: registry.salsa.debian.org/salsa-ci-team/ci-image-git-buildpackage:latest
@@ -75,10 +67,12 @@ debian_ci:
- cd $CI_PROJECT_DIR/.. && (apt-get source --download-only -t experimental firejail || apt-get source --download-only firejail)
- cd $CI_PROJECT_DIR && tar xf ../firejail_*.debian.tar.*
- rm -rf debian/patches/
+ # next line is a temporary fix for dh_missing failure; remove it after next release
+ - echo "etc/firejail/*.config" >> debian/firejail.install
- VERSION=$(grep ^PACKAGE_VERSION= configure | cut -d"'" -f2) && dch -v ${VERSION}-0.1~ci "Non-maintainer upload." && git archive -o ../firejail_${VERSION}.orig.tar.gz HEAD && pristine-tar commit ../firejail_${VERSION}.orig.tar.gz ci_build && git branch -m pristine-tar origin/pristine-tar
- git add debian && git commit -m "add debian/"
- export CI_COMMIT_SHA=$(git rev-parse HEAD)
script:
- - apt-get --no-install-recommends install pkg-config
+ - apt-get --no-install-recommends install -y -qq gawk
- gitlab-ci-git-buildpackage
- gitlab-ci-lintian
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index f1590aaa27e..00000000000
--- a/.travis.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-language: c
-dist: trusty
-sudo: true
-
-script:
- - sudo apt-get -y install expect csh xzdec lintian fakeroot
- - ( ./configure --enable-fatal-warnings --prefix=/usr && make && sudo make install && make test-travis )
- - ( sudo make install-strip DESTDIR=$(readlink -f appdir) )
-# # If successful, build release tarball
-# - ( cd appdir/ ; tar cfvj ../firejail-build$TRAVIS_BUILD_NUMBER.tar.bz2 . )
-# - curl --upload-file ./firejail-*.tar.bz2 https://transfer.sh/firejail-build$TRAVIS_BUILD_NUMBER.tar.bz2
-# - # Could use https://github.com/probonopd/uploadtool to upload to GitHub Releases instead
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 07a9eef04be..0f868d6c47e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,7 +25,7 @@ ensure that **both** of the following were installed:
firejail-profiles was not installed when installing firejail.
We take security bugs very seriously. If you believe you have found one, please report it by
-emailing us at netblue30@yahoo.com
+emailing us at netblue30@protonmail.com
# Opening an pull request:
Pull requests with enhancements, bugfixes or new profiles are very welcome.
@@ -34,6 +34,13 @@ If you want to write a new profile, the easiest way to do this is to use the
[profile template](https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template).
If you have already written a profile, please make sure it follows the rules described in the template.
+If you add a new command, here's the checklist:
+
+ - [ ] Update manpages: firejail(1) and firejail-profile(5)
+ - [ ] Update shell completions
+ - [ ] Update vim syntax files
+ - [ ] Update --help
+
# Editing the wiki
You are highly encouraged to add your own tips and tricks to the [wiki](https://github.com/netblue30/firejail/wiki).
diff --git a/COPYING b/COPYING
index b6e1c33e049..d159169d105 100644
--- a/COPYING
+++ b/COPYING
@@ -1,12 +1,12 @@
- GNU GENERAL PUBLIC LICENSE
- Version 2, June 1991
+ GNU GENERAL PUBLIC LICENSE
+ Version 2, June 1991
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
- 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
- Preamble
+ Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.) You can apply it to
+the GNU Lesser General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
@@ -55,8 +55,8 @@ patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
-
- GNU GENERAL PUBLIC LICENSE
+
+ GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
@@ -110,7 +110,7 @@ above, provided that you also meet all of these conditions:
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
-
+
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
@@ -168,7 +168,7 @@ access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
-
+
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
@@ -225,7 +225,7 @@ impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
-
+
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
@@ -255,7 +255,7 @@ make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
- NO WARRANTY
+ NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
@@ -277,4 +277,63 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
- END OF TERMS AND CONDITIONS
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+ If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+ To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+ Output of firejail --debug /path/to/program
+``` -OUTPUT OF `firejail --debug PROGRAM` +output goes here ``` +
- Firejail Intro +  Firejail Intro |
 Firejail Demo +alt="Firejail Demo" width="240" height="180" border="10" /> Firejail Demo |
 Debian Install +alt="Debian Install" width="240" height="180" border="10" /> Debian Install |
@@ -43,13 +44,19 @@ alt="Firejail Intro video" width="240" height="180" border="10" />
 Arch Linux Install +alt="Arch Linux Install" width="240" height="180" border="10" /> Arch Linux Install |
 Disable Network Access +alt="Disable Network Access" width="240" height="180" border="10" /> Disable Network Access + + |
+
+ Firejail Security Deep Dive |